Why your VPN stopped working in Russia, and how to turn on NvoVPN's stealth mode

If a VPN that worked for years suddenly stops connecting, it is not your device's fault: networks have learned to recognize VPN protocols and throttle them. The VPN that works in Russia today is the one that disguises the connection as an ordinary website; in the NvoVPN app, that is stealth mode, and it switches on by itself. Below is how to turn it on manually in four steps if the automatic switch did not help, and how all of this works in plain words: DPI, AmneziaWG and VLESS/Reality.

1. 1

   Turn on "Maximum reliability" in the app

   The NvoVPN home screen has a "Maximum reliability" toggle. Turn it on — the connection will always go through stealth mode, with no waiting for the network to throttle the main protocol. The same setting is under "Application" → "Stealth mode" — "Disabled", "Auto (on block)" (switches on by itself when blocked, the default), "Always on".

2. 2

   Need a different client? Open your account → "Stealth mode"

   A separate app is for a device without NvoVPN, or as a spare client at hand. In your account → "Stealth mode" there is a subscription link — it holds all servers at once — and a QR code.

3. 3

   Install v2RayTun or Hiddify and add the subscription

   v2RayTun is a free app for iPhone and Android; Hiddify covers all platforms, including Windows, Mac and Linux. In your account, tap "Connect in one tap (v2RayTun)" or "Open in Hiddify" — the servers are added by themselves. On a computer, just copy the subscription link and paste it into the app. If you are in Russia and have an iPhone, read the block below.

4. 4

   Tap "Connect" and check

   The app picks a working server by itself. Not going through? Switch to the next one on the list. Open "What is my IP": you will see the server's address, not your provider's.

How a network recognizes a VPN

Carriers run deep packet inspection equipment — DPI. It looks not only at where a packet is going but at what it looks like. VPN protocols give themselves away in four ways:

• Handshake signature. WireGuard's first packet is always 148 bytes, the reply 92, and they start with the same bytes every time. That fingerprint is caught in a second.
• TLS fingerprint. OpenVPN and many proxies list their ciphers in a different order than a real browser does — enough to tell them apart.
• Traffic that is too random. A stream with no structure at all is suspicious by itself — no ordinary website looks like that.
• Hosting addresses. Whole IP ranges of the data centers where VPN servers live get throttled or cut off wholesale.

That is why, starting in 2023, OpenVPN and IPsec stopped working in Russia first, then WireGuard and Shadowsocks, and by 2026 plain WireGuard gets through almost nowhere. Similar filters have long been in place in China, Iran, Turkmenistan and parts of the UAE's networks.

What AmneziaWG changes

AmneziaWG is NvoVPN's main protocol: the same open-source WireGuard, but without the "fingerprints" that DPI uses to recognize the original. In the configuration, this shows up as a few oddly named parameters:

• Jc, Jmin, Jmax — before the real handshake, the client sends a few "junk" packets of random size. The "148 → 92 bytes" sequence disappears.
• S1, S2 — random padding is added to the service packets, so their size no longer matches the reference.
• H1–H4 — the packet headers that the filter used to identify WireGuard are replaced.

Speed and encryption are the same as WireGuard's — you will not notice a difference on your phone. The app fills in the parameters itself, and they are already written into the file from your account. Important: a plain WireGuard client will bring such a file up, but without the obfuscation — on filtered networks you specifically need an AmneziaWG client.

Stealth mode: VLESS/Reality

Some networks cut any unfamiliar UDP traffic. For them, NvoVPN has a second protocol — VLESS with Reality technology. Your phone sets up a perfectly ordinary TLS connection with the server, the same kind used to open any website, and the server presents the genuine certificate of a large public site. To the filter, this is indistinguishable from you simply visiting that site; your traffic travels inside the connection.

Reality also withstands "active probing" — when the inspection system itself knocks on a suspicious address: the server answers a stranger's request just like the ordinary camouflage site would. It runs over TCP, like HTTPS, so it gets through even where UDP is blocked entirely — hotel and office networks.

How this works in the app

There is nothing to choose. The app connects over AmneziaWG and watches whether data is flowing. If the handshake went through but there is no traffic — the classic sign of a DPI cutoff — it switches to stealth mode by itself and remembers that this network needs it. This takes up to a minute. Hence the advice in "What to do if the VPN will not connect": wait and reconnect before changing anything by hand.

Which mode, and when

A quick word on the rules

Using a VPN as a private individual is not banned in Russia — the restrictions concern advertising such services and access to specific banned material. We describe how the technology works on your own devices; you are responsible for which sites you open. This is not legal advice: rules change, so check local regulations before you travel.

FAQ

How does AmneziaWG compare with WireGuard on speed? Practically no difference: the "junk" packets are only sent while the connection is being set up; after that it is the same WireGuard.

Why can't I just change the port? The filter looks at the contents of packets, not the port number. Changing the port helped about ten years ago; it does not anymore.

Does stealth mode work on a router? Not out of the box: routers use an AmneziaWG or WireGuard configuration. For a router on a heavily filtered network, message support and we will look at your model.

What if stealth mode will not connect either? Change the server, then the network, then message support with your carrier's name and the time of the attempt — reports like this let us see new blocks before our monitoring does.

Related guides: VPN for China: what works in 2026 · AmneziaWG vs WireGuard: what is the difference · What to do if the VPN will not connect